Deep Dive · Privacy Engineering

Three Layers of Referrer Stripping: How TraceNull Kills the Referer Header at Every Level

Published May 2025 · 8 min read · By the TraceNull Team

Most URL shorteners promise privacy but rely on a single mechanism to strip the Referer header. If that one layer fails — due to a browser quirk, a misconfigured proxy, or an edge case in the HTTP spec — your referrer data leaks silently to the destination site. The site owner sees where you came from, your affiliate network sees the intermediary, and your privacy guarantee is broken.

TraceNull takes a fundamentally different approach. We strip the Referer header at three independent layers of the stack: the application server (Node.js + Express), the reverse proxy (Caddy), and the HTML document itself (meta tag). If any single layer fails, the other two still protect you.

This article explains exactly how each layer works, why defense-in-depth matters for referrer privacy, and how you can verify it yourself.

Wait — What Is the Referer Header, and Why Should You Care?

When you click a link on Page A that takes you to Page B, your browser automatically sends an HTTP header called Referer (yes, the original HTTP spec has this typo baked in permanently). This header contains the full URL of Page A.

That means the destination site knows:

• Which website sent the visitor
• The exact page URL, including query parameters
• Any UTM tags, session IDs, or tokens embedded in the URL

For affiliate marketers, this is a serious problem. If you shorten a link through a service that doesn't strip referrers properly, the merchant can see your traffic source, your landing page strategy, and potentially your entire funnel. Competitors monitoring referrer logs get a free look at your playbook.

Layer 1: Node.js Application Headers

The first line of defense lives in TraceNull's Express application. When a short link is resolved and the redirect response is generated, we set the Referrer-Policy header directly on the HTTP response.

The Referrer-Policy: no-referrer header instructs the browser to send absolutely no referrer information when following the redirect. This is the strictest possible value defined in the W3C Referrer Policy specification.

Why This Layer Alone Isn't Enough

Application-level headers can be overridden or dropped in several scenarios:

• A downstream proxy or CDN strips or rewrites headers
• A bug in the application code skips the middleware for certain routes
• Some older HTTP clients ignore Referrer-Policy entirely

If this were our only layer, a single deployment mistake could silently expose referrer data. That's why we don't stop here.

Layer 2: Caddy Reverse Proxy Headers

TraceNull runs behind Caddy, a modern reverse proxy that handles TLS termination and HTTP/2. We configure Caddy to inject the Referrer-Policy header on every single response that leaves the server, regardless of what the application does.

This is a server-level enforcement that operates independently of the Node.js application. Even if the Express middleware were disabled, misconfigured, or bypassed entirely, Caddy would still set the header.

Why Two Header Layers?

You might wonder: if both layers set the same header, isn't one redundant? That's exactly the point. Redundancy is the foundation of defense-in-depth security.

Consider these real-world failure scenarios:

The probability of both the application and the proxy failing simultaneously on the same request is extremely low. But even in that worst case, we have Layer 3.

Layer 3: HTML Meta Tag (The Client-Side Guarantee)

For redirect pages that briefly render HTML before forwarding the user (such as password-protected links or interstitial pages), TraceNull injects a <meta> tag directly into the HTML document:

This tag is parsed by the browser before any navigation occurs. It serves as a client-side instruction that's completely independent of HTTP headers. Even if a network intermediary (corporate proxy, ISP, CDN) strips all custom HTTP headers from the response, the meta tag survives because it's embedded in the HTML body.

When the Meta Tag Saves You

• Corporate proxies that strip security headers but pass HTML through unchanged
• Browser extensions that modify response headers but don't alter page content
• Cached pages served from a CDN that may not preserve all original headers
• Unusual HTTP clients that process HTML but ignore certain headers

How the Three Layers Work Together

Here's the complete flow when someone clicks a TraceNull short link:

Verify It Yourself

Don't take our word for it. You can verify TraceNull's referrer stripping using free tools:

Method 1: Browser DevTools

1. Create a short link at tracenull.cc
2. Open your browser's Developer Tools (F12) → Network tab
3. Click the short link
4. Inspect the redirect response headers — you'll see Referrer-Policy: no-referrer
5. Check the request to the destination — the Referer header will be absent

Method 2: Use a Referrer Checker

1. Create a TraceNull short link pointing to a referrer-checking service like https://www.whatismyreferer.com/
2. Click the short link
3. The checker will show no referrer — confirming the headers were stripped

Method 3: cURL Inspection

Look for Referrer-Policy: no-referrer in the response headers. It will be there, set by both Caddy and Node.js.

Why Most Shorteners Don't Do This

The honest answer: because it's unnecessary for their business model. Services like Bitly and TinyURL want referrer data to flow — it powers their analytics dashboards and the data they sell to enterprise customers. Stripping referrers would undermine their core revenue model.

Even privacy-focused alternatives often implement only a single layer (usually just the meta tag or just one header). That's better than nothing, but it leaves gaps that real-world network conditions can exploit.

Who Benefits Most from Triple-Layer Stripping?

• Affiliate marketers: Prevent merchants and networks from seeing your traffic sources and funnel pages
• Publishers: Share links without revealing your internal CMS URLs or editorial workflow
• B2B teams: Share documents and resources without exposing internal tool URLs in referrer logs
• Privacy advocates: Distribute links on forums, social media, or email without creating a breadcrumb trail

The Bottom Line

Privacy isn't a feature you bolt on with a single HTTP header and call it done. It's an engineering discipline that requires redundancy, verification, and a healthy paranoia about failure modes.

TraceNull's three-layer referrer stripping — Node.js application headers, Caddy server headers, and HTML meta tags — ensures that no single point of failure can expose your referrer data. Each layer operates independently, and all three would have to fail simultaneously for any leakage to occur.

That's what privacy-first actually means: not one wall, but three.